A network timeout is ambiguous to the client: it can't tell whether the request failed before or after the server processed it. Retrying blindly risks sending the same email twice. An idempotency key, attached to the original request, lets a retry with the same key return the original result instead of triggering a second send.
Idempotency keys should be generated per logical send (an order confirmation, a password reset), not per HTTP attempt, so that retries from any layer of the calling stack collapse to the same key rather than each attempt minting a new one.
Keys are scoped and expire after a fixed retention window; reusing an expired key for a genuinely new message will be rejected as a duplicate of the original rather than treated as new.